CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
CLI_ARCH=amd64
if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
curl --proxy 192.168.0.109:10809 -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin
rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}


HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt)
HUBBLE_ARCH=amd64
if [ "$(uname -m)" = "aarch64" ]; then HUBBLE_ARCH=arm64; fi
curl --proxy 192.168.0.109:10809 -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}
sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum
sudo tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local/bin
rm hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}


ctr image pull docker.io/coredns/coredns:1.11.1

https://registry.cn-hangzhou.aliyuncs.com

sudo chattr -i /etc/resolv.conf
sudo cat <<EOF | sudo tee /etc/resolv.conf
nameserver 192.168.56.11
nameserver 8.8.8.8
EOF
# 设置只读
sudo chattr +i /etc/resolv.conf

cluster-pool-ipv4-cidr: 172.16.0.0/16

# helm cilium config
https://docs.cilium.io/en/stable/helm-reference/#id1
# Kubernetes Host Scope 让pod使用自己定义的cidr， 默认是Cluster Scope (Default) https://docs.cilium.io/en/latest/network/concepts/ipam/cluster-pool/#ipam-crd-cluster-pool
https://docs.cilium.io/en/latest/network/concepts/ipam/kubernetes/#k8s-hostscope


helm repo add cilium https://helm.cilium.io/
helm pull cilium/cilium
tar zxf cilium-1.14.5.tgz
sed -i "s#quay.io/#m.daocloud.io/quay.io/#g" ~/cilium/values.yaml
helm install cilium ~/cilium \
--namespace kube-system \
--set operator.replicas=1 \
--set ipam.mode=kubernetes \
--set enableIPv4Masquerade=true \
--set enableIPv6Masquerade=true \
--set bpf.masquerade=true \
--set k8sServiceHost=192.168.56.110 \
--set k8sServicePort=8443 \
--set kubeProxyReplacement=strict \
--set endpointRoutes.enabled=true


helm repo add coredns https://coredns.github.io/helm
helm install coredns coredns/coredns --set service.clusterIP="10.96.0.10" --set image.repository=m.daocloud.io/docker.io/coredns/coredns --namespace kube-system


curl --proxy $PROXY -LO https://raw.githubusercontent.com/cilium/cilium/1.14.5/examples/kubernetes/connectivity-check/connectivity-check.yaml
sed -i "s#google.com#baidu.com#g" connectivity-check.yaml
sed -i "s#quay.io/#m.daocloud.io/quay.io/#g" connectivity-check.yaml
kubectl create ns cilium-test
kubectl apply -n cilium-test -f ~/connectivity-check.yaml

# sudo iptables -P INPUT ACCEPT
# sudo iptables -P FORWARD ACCEPT
# sudo iptables -P OUTPUT ACCEPT
# sudo iptables -F
kubectl run -it --rm test --image=registry.cn-hangzhou.aliyuncs.com/acs/curl --restart=Never -- /bin/sh
kubectl run -it --rm busybox --image=m.daocloud.io/docker.io/library/busybox:1.28 --restart=Never -- nslookup kubernetes.default
kubectl run -it --rm busybox --image=m.daocloud.io/docker.io/library/busybox:1.28 --restart=Never -- nslookup www.baidu.com
kubectl -n kube-system exec ds/cilium -- cilium status --verbose


kubectl delete ns cilium-test
helm uninstall coredns --namespace=kube-system
helm uninstall cilium --namespace=kube-system
for crd in $(kubectl get crd -o jsonpath="{.items[*].metadata.name}"); do
  kubectl delete crd/$crd
done


# 查看网络策略 damaset 
kubectl exec -n kube-system -t ds/cilium -- cilium policy get

# 监听dns情况
kubectl exec -it -n kube-system cilium-4n4p7 -- cilium monitor|grep ":53 "

# 你可以使用cilium bpf ipcache list命令来输出ipcache条目
kubectl exec -it -n kube-system cilium-4n4p7 -- cilium bpf ipcache list

# Cilium 使用cilium identity list命令来输出所有的 identities。 在 Cilium 中，每个网络端点被赋予一个唯一的 Security Identity，该身份允许 endpoint 根据网络策略进行权限控制。
kubectl exec -it -n kube-system cilium-4n4p7 -- cilium identity list

# 查看cilium在k8s中的CRD资源
kubectl get ciliumnetworkpolicies -A
